agentwallet-mcp 1.14.5 → 1.14.7

package/README.md

@@ -256,7 +256,7 @@ pay_x402(
 
 **Asset risk.** `check_token_risk` (and every `approve_token` result) reports honeypot, tax, owner-power, verified-source, holder-concentration and liquidity flags from GoPlus Security, with an on-chain fallback. A warning for the caller to weigh, never a block.
 
-**Proof.** Real settlements are listed in [PAYMENTS.md](https://github.com/hifriendbot/agentwallet-mcp/blob/main/PAYMENTS.md); the first is a 0.02 USDC `exact` payment on Base with the facilitator paying the gas.
+**Proof.** Real settlements are listed in [PAYMENTS.md](https://github.com/hifriendbot/agentwallet-mcp/blob/main/PAYMENTS.md); the first is a 0.02 USDC `exact` payment on Base with the facilitator paying the gas. The same list, rendered with Basescan links, is at [hifriendbot.com/wallet/payments](https://hifriendbot.com/wallet/payments/), and a five-minute walkthrough from install to a real settlement is at [hifriendbot.com/wallet/quickstart](https://hifriendbot.com/wallet/quickstart/). Security policy, fixed disclosures and the release history: [hifriendbot.com/security](https://hifriendbot.com/security/) and [hifriendbot.com/changelog](https://hifriendbot.com/changelog/).
 
 ## Pay any x402 API from Claude in three steps
 
@@ -374,7 +374,7 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 ```
 
 - **`budget`**: rolling dollar budgets (last 24 hours, last 30 days, lifetime) across every chain, counting x402 payments, stablecoin transfers and stablecoin approvals in registry stablecoins. A spend the budget cannot price (a token outside the registry) is refused while a budget is set, unless `"unpriced_spends": "allow"`. An SPL send is priced at the mint's own decimals; a `token_decimals` hint that disagrees with the mint is refused before any request is made.
-- **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract).
+- **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract) and, in local Solana mode, the rent an SPL send pays to create the recipient's token account (the recipient owns that account and can close it for the lamports; the ledger records it as its own line, method `rent`, to the recipient, and `assets.allow` does not need to list `native` for it).
 - **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `approveAndCall`, Permit2 `approve`, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused outright, since no budget can count it; grant an exact amount. A zero-value call to any other contract (a router, a bridge) reserves nothing: it can only pull what an approval already granted.
 - **`hosts`**, **`per_host`**: which endpoints `pay_x402` may pay, and how much per host per day, per month and per payment. A denied host is never contacted, not even for a quote. A host is matched by its canonical DNS name (lowercase, the root label's trailing dot removed), so `api.example.com.` and its percent-encoded spelling are `api.example.com` to every list and to the ledger's per-host sums.
 - **`recipients`**: where funds may go (transfers, x402 `payTo`, approval spenders, contracts that receive native value). The allow list covers those funds destinations; the contract a zero-value call is aimed at (a token being approved, a router) is checked against the deny list and the chain list.

package/build/index.js

@@ -30,7 +30,7 @@ import { WRAPPED_NATIVE } from './wrapped-native.js';
 import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, permit2Address, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
 import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, decodeAbiString as decodeDomainString, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, settlementVerdict, legacyReceiptAllowed, sanitizeRequired, } from './x402-eip3009.js';
-import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, mintDecimalsStrict, } from './local-solana.js';
+import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, mintDecimalsStrict, splAccountRent, } from './local-solana.js';
 import { localSimulate } from './local-wallet.js';
 import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, hostOf, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
 import { Ledger } from './ledger.js';
@@ -92,7 +92,10 @@ function reserveSpend(input) {
     const chain = chainAllowed(p, input.chainId);
     if (!chain.ok)
         throw new Error(chain.reason + ' Nothing was signed.');
-    const asset = assetAllowed(p, input.chainId, input.asset);
+    // Rent is SOL by nature, not by choice: the operator allowed the token, and
+    // the account that holds it is paid for in the chain's coin, so assets.allow
+    // does not have to list native for the rent line. native_budget counts it.
+    const asset = input.method === 'rent' ? { ok: true } : assetAllowed(p, input.chainId, input.asset);
     if (!asset.ok)
         throw new Error(asset.reason + ' Nothing was signed.');
     const to = recipientAllowed(p, input.to);
@@ -105,7 +108,7 @@ function reserveSpend(input) {
 /** The same checks with nothing recorded, for quotes and simulations. */
 function spendVerdict(input) {
     const p = POL();
-    for (const r of [chainAllowed(p, input.chainId), assetAllowed(p, input.chainId, input.asset), recipientAllowed(p, input.to)])
+    for (const r of [chainAllowed(p, input.chainId), input.method === 'rent' ? { ok: true } : assetAllowed(p, input.chainId, input.asset), recipientAllowed(p, input.to)])
         if (!r.ok)
             return r;
     const limits = limitsFor(input.host);
@@ -141,7 +144,19 @@ async function describeSend(body, chainId) {
         // reached the custodian (reported privately 2026-10-24, 1.14.5). The chain
         // would have refused the TransferChecked, but the ledger was already wrong.
         const given = Number.isInteger(d) && d >= 0 && d <= 36 ? d : undefined;
-        return { kind: 'spl', to: String(body.to || ''), asset: mint, raw: String(body.value ?? '0'), decimals: await verifiedDecimals(chainId, mint, given) };
+        const to = String(body.to || '');
+        const decimals = await verifiedDecimals(chainId, mint, given);
+        // In local mode this process is the payer: when the recipient has no token
+        // account yet, the send creates one and the rent is native value leaving
+        // the wallet, reserved here from the same reading the signer will make.
+        // The hosted custodian pays its own rent and bounds it on its side.
+        let carried;
+        if (isSolanaLocalMode() && to) {
+            const rent = await splAccountRent(mint, to, chainId);
+            if (rent > 0n)
+                carried = { raw: rent.toString(), to, rent: true };
+        }
+        return { kind: 'spl', to, asset: mint, raw: String(body.value ?? '0'), decimals, ...(carried ? { carried } : {}) };
     }
     const data = String(body.data || '');
     const to = String(body.to || '');
@@ -221,7 +236,9 @@ function assertSendTarget(d, chainId) {
  * recipients.allow and .deny bind who may be allowed to pull; the native
  * value of a contract call is a spend to that contract; the native value
  * carried on a token or approval call is a second spend, native, to the
- * called contract (1.14.4). Throws for an unbounded approval under a policy.
+ * called contract (1.14.4); the rent a local SPL send pays for the recipient's
+ * token account is a native spend to the recipient, method 'rent' (1.14.7).
+ * Throws for an unbounded approval under a policy.
  */
 function spendInputsOf(d, chainId, tool, wallet, ctx = {}) {
     if (d.kind === 'approval' && d.unbounded && POLICY.path) {
@@ -238,7 +255,7 @@ function spendInputsOf(d, chainId, tool, wallet, ctx = {}) {
         });
     }
     if (d.carried) {
-        out.push({ ...base, asset: '', assetLabel: assetLabel(chainId, ''), raw: d.carried.raw, decimals: nativeDecimals(chainId), usd: null, to: d.carried.to, method: 'native' });
+        out.push({ ...base, asset: '', assetLabel: assetLabel(chainId, ''), raw: d.carried.raw, decimals: nativeDecimals(chainId), usd: null, to: d.carried.to, method: d.carried.rent ? 'rent' : 'native' });
     }
     return out;
 }
@@ -1175,7 +1192,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.5',
+    version: '1.14.7',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'

package/build/ledger.d.ts

@@ -1,6 +1,9 @@
 import { type Spent } from './policy.js';
-/** 'approval' is an ERC-20 allowance granted (approve, increaseAllowance, Permit2.approve): a spend the spender executes later, counted when granted. */
-export type SpendMethod = 'eip3009' | 'permit2' | 'transfer' | 'native' | 'spl' | 'autopay' | 'approval';
+/**
+ * 'approval' is an ERC-20 allowance granted (approve, increaseAllowance, Permit2.approve): a spend the spender executes later, counted when granted.
+ * 'rent' is the SOL an SPL send pays to create the recipient's token account (1.14.7): native, to the recipient, who owns the account and can close it for the lamports.
+ */
+export type SpendMethod = 'eip3009' | 'permit2' | 'transfer' | 'native' | 'spl' | 'autopay' | 'approval' | 'rent';
 export interface SpendEntry {
     seq: number;
     ts: string;

package/build/local-solana.d.ts

@@ -76,6 +76,16 @@ export declare function localSolTransfer(to: string, lamports: string, chainId?:
  * not exist, using the idempotent instruction so a race cannot fail the send.
  */
 export declare function localSplTransfer(mintStr: string, to: string, rawAmount: string, decimals: number, chainId?: number): Promise<LocalSolResult>;
+/**
+ * The SOL an SPL send to `to` spends on creating the recipient's token
+ * account, in lamports; 0n when the account exists. The recipient owns that
+ * account and can close it to keep the lamports, so it is native value leaving
+ * the wallet and the spend policy reserves it against native_budget before the
+ * send is built (reported privately 2026-10-26: it was checked against the
+ * per-transaction SOL cap only, and fresh recipients took SOL past the daily
+ * budget while the ledger held token lines alone).
+ */
+export declare function splAccountRent(mintStr: string, to: string, chainId?: number): Promise<bigint>;
 export declare function solanaWalletRecord(): {
     id: string;
     address: string;

package/build/local-solana.js

@@ -448,31 +448,15 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     const mint = new PublicKey(mintStr);
     const recipient = new PublicKey(to);
     await assertRecipientIsWallet(conn, recipient);
-    const { tokenProgram, ataSize } = await mintLayout(conn, mint);
+    const { tokenProgram, destAta, rent } = await destinationAccount(conn, mint, recipient);
     const sourceAta = associatedTokenAddress(payer.publicKey, mint, tokenProgram);
-    const destAta = associatedTokenAddress(recipient, mint, tokenProgram);
     const tx = new Transaction();
-    const destInfo = await conn.getAccountInfo(destAta);
-    // The associated-account program creates into an address that already holds
-    // plain SOL (system-owned, no data): it tops up the rent, allocates and
-    // assigns. Only an address holding something else cannot become the token
-    // account (2026-10-04 round 2; the 1.13.5 refusal of any occupant let anyone
-    // block a recipient for the price of the rent-exempt minimum).
-    const prefunded = destInfo !== null && destInfo.owner.equals(SystemProgram.programId) && destInfo.data.length === 0;
-    if (destInfo && !destInfo.owner.equals(tokenProgram) && !prefunded) {
-        throw new Error(`Refusing to send: the recipient's token account address ${destAta.toBase58()} is occupied by an account owned by ${destInfo.owner.toBase58()}, so no token account can be created there.`);
-    }
-    if (!destInfo || prefunded) {
+    if (rent > 0n) {
         // Creating the recipient's token account costs the payer rent in SOL, an
         // outflow the SOL cap must see (0.002 SOL a time adds up over many sends).
-        // Rent follows the account's real size, which for Token-2022 is above 165;
-        // SOL already sitting at the address reduces what the payer tops up.
-        // The node's rent figure is floored at the cluster constant and the SOL the
-        // node says already sits at the address is not credited: both are numbers a
-        // lying RPC used to zero so the create went out under the cap (round 4).
-        const claimed = Number(await conn.getMinimumBalanceForRentExemption(ataSize));
-        const rent = Math.max(Number.isFinite(claimed) ? Math.trunc(claimed) : 0, (128 + ataSize) * 6960);
-        assertWithinSolCap(BigInt(rent));
+        // The policy reserved the same figure against native_budget before this
+        // call (1.14.7); the cap is the per-transaction floor under it.
+        assertWithinSolCap(rent);
         tx.add(createAtaIdempotentIx(payer.publicKey, destAta, recipient, mint, tokenProgram));
     }
     tx.add(transferCheckedIx(tokenProgram, sourceAta, mint, destAta, payer.publicKey, BigInt(rawAmount), decimals));
@@ -487,6 +471,52 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
         signed_locally: true,
     };
 }
+/**
+ * The recipient's associated account for a mint, and the rent the payer funds
+ * when it has to be created: 0 when it already exists. One reading shared by
+ * the send and by the policy's reservation, so the ledger line and the
+ * instruction carry the same figure.
+ *
+ * The associated-account program creates into an address that already holds
+ * plain SOL (system-owned, no data): it tops up the rent, allocates and
+ * assigns. Only an address holding something else cannot become the token
+ * account (2026-10-04 round 2; the 1.13.5 refusal of any occupant let anyone
+ * block a recipient for the price of the rent-exempt minimum).
+ *
+ * Rent follows the account's real size, which for Token-2022 is above 165;
+ * SOL already sitting at the address reduces what the payer tops up. The
+ * node's rent figure is floored at the cluster constant and the SOL the node
+ * says already sits at the address is not credited: both are numbers a lying
+ * RPC used to zero so the create went out under the cap (round 4).
+ */
+async function destinationAccount(conn, mint, recipient) {
+    const { tokenProgram, ataSize } = await mintLayout(conn, mint);
+    const destAta = associatedTokenAddress(recipient, mint, tokenProgram);
+    const destInfo = await conn.getAccountInfo(destAta);
+    const prefunded = destInfo !== null && destInfo.owner.equals(SystemProgram.programId) && destInfo.data.length === 0;
+    if (destInfo && !destInfo.owner.equals(tokenProgram) && !prefunded) {
+        throw new Error(`Refusing to send: the recipient's token account address ${destAta.toBase58()} is occupied by an account owned by ${destInfo.owner.toBase58()}, so no token account can be created there.`);
+    }
+    if (destInfo && !prefunded)
+        return { tokenProgram, destAta, rent: 0n };
+    const claimed = Number(await conn.getMinimumBalanceForRentExemption(ataSize));
+    const rent = Math.max(Number.isFinite(claimed) ? Math.trunc(claimed) : 0, (128 + ataSize) * 6960);
+    return { tokenProgram, destAta, rent: BigInt(rent) };
+}
+/**
+ * The SOL an SPL send to `to` spends on creating the recipient's token
+ * account, in lamports; 0n when the account exists. The recipient owns that
+ * account and can close it to keep the lamports, so it is native value leaving
+ * the wallet and the spend policy reserves it against native_budget before the
+ * send is built (reported privately 2026-10-26: it was checked against the
+ * per-transaction SOL cap only, and fresh recipients took SOL past the daily
+ * budget while the ledger held token lines alone).
+ */
+export async function splAccountRent(mintStr, to, chainId = 900) {
+    const conn = connection(chainId);
+    await assertCluster(conn, chainId);
+    return (await destinationAccount(conn, new PublicKey(mintStr), new PublicKey(to))).rent;
+}
 const TOKEN_ACCOUNT_SIZE = 165;
 const MINT_SIZE = 82;
 /** Token-2022 pads a mint to the token-account size and tags the next byte: 1 = mint, 2 = token account. */

package/build/policy.js

@@ -13,6 +13,7 @@
  */
 import { readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
+import { dirname, isAbsolute, join } from 'node:path';
 import { z } from 'zod';
 const Dec = z.string().regex(/^\d+(\.\d+)?$/, 'a decimal number as a string, like "5" or "0.25"');
 const Window = z.object({ daily: Dec.optional(), monthly: Dec.optional(), total: Dec.optional() }).strict();
@@ -118,12 +119,15 @@ export function loadPolicy(env = process.env) {
     }
     const policy = parsePolicy(text);
     const hash = createHash('sha256').update(text).digest('hex');
-    const dir = file.replace(/[\\/][^\\/]*$/, '') || '.';
+    // The ledger lives beside the policy file. dirname() gives '.' for a bare
+    // filename; a hand-rolled strip-after-last-slash left the filename itself as
+    // the directory, so AGENTWALLET_POLICY=policy.json could not start (1.14.6).
+    const dir = dirname(file);
     let ledgerPath = ledgerEnv || null;
     if (!ledgerPath && policy.ledger)
-        ledgerPath = /^([a-zA-Z]:)?[\\/]/.test(policy.ledger) ? policy.ledger : `${dir}/${policy.ledger}`;
+        ledgerPath = isAbsolute(policy.ledger) ? policy.ledger : join(dir, policy.ledger);
     if (!ledgerPath && needsLedger(policy))
-        ledgerPath = `${dir}/agentwallet-ledger.jsonl`;
+        ledgerPath = join(dir, 'agentwallet-ledger.jsonl');
     return { policy, path: file, hash, ledgerPath };
 }
 /** A budget is only meaningful across restarts, so it needs a file. */

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.5",
+  "version": "1.14.7",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs && node test/audit-11312.test.mjs && node test/audit-11313.test.mjs && node test/audit-11316.test.mjs && node test/spend-policy.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs && node test/audit-11312.test.mjs && node test/audit-11313.test.mjs && node test/audit-11316.test.mjs && node test/spend-policy.test.mjs && node test/policy-path-resolution.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [